Re: [RFC PATCH v1.1 02/14] mm/damon/core: do not use region out of a loop in damon_set_regions()

[SeongJae Park <sj@kernel.org>]

On Thu, 21 May 2026 04:19:49 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Integer overflow in ALIGN() can result in region with ar.end = 0
> --
> 
> commit d65dcd33c6063ed27bd90da3803c482628ebbc88
> Author: SeongJae Park <sj@kernel.org>
> 
> mm/damon/core: do not use region out of a loop in damon_set_regions()
> 
> This commit cleans up damon_set_regions() to explicitly track if a region
> should be inserted before another, avoiding reliance on undocumented
> iterator behavior. No behavioral changes are intended.
> 
> > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > index d0bdf6e01dff8..669fd13776ea2 100644
> > --- a/mm/damon/core.c
> > +++ b/mm/damon/core.c
> 
> [ ... ]
> 
> > @@ -394,7 +397,11 @@ int damon_set_regions(struct damon_target *t, struct damon_addr_range *ranges,
> >  					ALIGN(range->end, min_region_sz));
> 
> [Severity: High]
> This is a pre-existing issue,

So, no blocker of this series.

> but can this ALIGN() macro overflow if
> userspace provides ULONG_MAX as the region end via the sysfs interface?

It is technically possible.  But what sane user would use such input?

> 
> If range->end is ULONG_MAX and min_region_sz is 4096, the ALIGN() macro
> would evaluate to 0, resulting in a region where ar.end is 0.

And it will trigger WARN_ONCE() on multiple verification points in
CONFIG_DAMON_DEBUG_SANITY enabled kernels.

> 
> When damon_sz_region() subsequently calculates the size using
> r->ar.end - r->ar.start, the unsigned arithmetic would underflow to a
> massive size.
> 
> This could cause the while (damon_sz_region(r) > max_region_sz) loop in
> damon_apply_min_nr_regions() to iterate nearly endlessly, allocating new
> regions until memory is exhausted.

If there is a region having end address equal to or smaller than the start
address, I think not only damon_apply_min_nr_regions() but multiple logics in
DAMON will behave crazily.  But, as I mentioned at the beginning, it is unclear
if it is a sane user input that deserve to be supported.  Of course I might
missing something, but I will revisit this if the first question is answered by
someone.


Thanks,
SJ

[...]